All data which identifies an individual human subject, health care provider, or health care facility are regarded as confidential by the Health Effectiveness Research Center (HERCe, hereinafter referred to as the Center) and are subject to the following specific regulations for the maintenance of privacy.  Employees of the Center are instructed on their responsibility to protect the security and privacy of data and must agree to such as a condition of employment.  It is also the responsibility of all other users of HERCe data and resources to protect the security and privacy of data and they must agree to such as a condition of conducting research through HERCe.

Specific regulations are as follows:

1. No information identifying an individual (either human subject or health care provider) will be released to anyone other than Center staff unless specific instructions and permissions or approvals have been obtained in advance from the HERCe director, the agency providing the data or the individual him/herself. 
2. No information identifying an individual facility will be released to anyone other than Center staff, except to that specific facility or to the agency providing the data.  An exception to this may be a request to provide facility specific data when a written agreement is signed between two or more facilities.
3. All staff members are required to read the Security, Confidentiality and Protection of Human Subjects Policy and sign a Security and Confidentiality Pledge before being granted access to any confidential data.  Staff are reminded that their pledge remains in effect after termination of employment with the Center.
4. All confidential data reside in 2120 Westlawn or on the HERCe secure server unless prior approval is obtained from the Principal Investigator.  Data is only to be used for projects specified by the Principal Investigator and for which there is University of Iowa Human Subjects Review Board approval and data use agreement, when applicable.  Confidential data should never be transferred via email or copied or moved to a laptop computer.  All work with confidential databases not stored on the HERCe secure server is performed using non-networked computers available in 2120 Westlawn. 
5. Users of the HERCe secure server agree to requirements set forth in the Information Technology Plan – HERCe.  Permission to access or store data on the secure server is granted by the Center Director. 
6. Workstations with access to the secure server are located in locked offices with limited user access and remote access to these workstations is disabled unless permission is obtained from the Center director.  Workstations used primarily by students will not generally be given permission for remote access.  Users who use remote access to their workstation agree to position their monitor in such a way as to prevent unauthorized viewing of confidential data.  All staff members agree not to copy or move confidential data to another folder without first notifying the Principal Investigator or senior data manager.  A list of all workstations and users accessing the secure server, the server folder names, and the user access groups for each folder name is maintained by Center staff.
7. The Center utilizes a certified mail system for confidential materials handled by the postal service and requires receipts for express and courier mail deliveries.

When the Center is involved in research studies that require direct contact with human subjects, the following steps are taken to assure that confidentiality and security are rigorously maintained and the rights and welfare of the human subjects are not jeopardized.

1. The study protocol must be approved by The University of Iowa Human Subjects Review Board.
2. Whenever possible, the individual’s approval (or that of his/her parent or guardian) must be sought.
3. The study plan must be reviewed for scientific merit by a peer review group of the sponsoring agency or if not funded, by the Center Director and/or Deputy Director or appropriate scientific advisors.

HERCe holdings of CMS data are subject to the terms of Data Use Agreements (DUA) and may be subject to additional security protections.  All persons with access to CMS data must review the applicable DUA(s) covering use of specific CMS data files and all access and use of CMS data must be conducted in full compliance with said DUA(s).”